Vulnerability-Lookup

CVE-2026-47121 (GCVE-0-2026-47121)

Vulnerability from cvelistv5 – Published: 2026-07-21 13:53 – Updated: 2026-07-22 14:30

Title

Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta

Summary

Sparkle is a software update framework for macOS. Prior to version 2.9.2, `Autoupdate/SUBinaryDeltaApply.m` enforces `relativePath.pathComponents containsObject:@".."` and rejects writes whose immediate parent directory IS itself a symbolic link, but does not detect symlinks deeper in the relative path. `Autoupdate/SPUSparkleDeltaArchive.m`'s `extractItem:` will create symlinks in the destination tree from archive content (no `..` check on the symlink target), and a subsequent `Extract` item targeting `<symlink>/foo/bar` then escapes the destination tree via `fopen(path, "wb")` because the kernel resolves the intermediate symlink during the open call. This is a defense-in-depth issue: exploitation requires a maliciously-crafted `.delta` that passes EdDSA signature verification, i.e. EdDSA private-key compromise. With the AppInstaller running as root for system-domain installs, it gives the holder of a stolen signing key arbitrary file write at root level via the delta-apply path, which is a strictly broader primitive than the "drop-in replacement bundle" install they would otherwise have. Version 2.9.2 contains a patch for the issue.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-22 14:30 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 8035 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/sparkle-project/Sparkle/securi…	x_refsource_CONFIRM
https://github.com/sparkle-project/Sparkle/commit…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
sparkle-project	Sparkle	Affected: < 2.9.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47121",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T14:30:24.947456Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-22T14:30:47.083Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/sparkle-project/Sparkle/security/advisories/GHSA-hg88-v3cw-3qrh"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Sparkle",
          "vendor": "sparkle-project",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.9.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Sparkle is a software update framework for macOS. Prior to version 2.9.2, `Autoupdate/SUBinaryDeltaApply.m` enforces `relativePath.pathComponents containsObject:@\"..\"` and rejects writes whose immediate parent directory IS itself a symbolic link, but does not detect symlinks deeper in the relative path. `Autoupdate/SPUSparkleDeltaArchive.m`\u0027s `extractItem:` will create symlinks in the destination tree from archive content (no `..` check on the symlink target), and a subsequent `Extract` item targeting `\u003csymlink\u003e/foo/bar` then escapes the destination tree via `fopen(path, \"wb\")` because the kernel resolves the intermediate symlink during the open call. This is a defense-in-depth issue: exploitation requires a maliciously-crafted `.delta` that passes EdDSA signature verification, i.e. EdDSA private-key compromise. With the AppInstaller running as root for system-domain installs, it gives the holder of a stolen signing key arbitrary file write at root level via the delta-apply path, which is a strictly broader primitive than the \"drop-in replacement bundle\" install they would otherwise have. Version 2.9.2 contains a patch for the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-21T13:53:05.030Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/sparkle-project/Sparkle/security/advisories/GHSA-hg88-v3cw-3qrh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sparkle-project/Sparkle/security/advisories/GHSA-hg88-v3cw-3qrh"
        },
        {
          "name": "https://github.com/sparkle-project/Sparkle/commit/fe7b718d0736f3e139e374e26fbca96f29e13bf0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sparkle-project/Sparkle/commit/fe7b718d0736f3e139e374e26fbca96f29e13bf0"
        }
      ],
      "source": {
        "advisory": "GHSA-hg88-v3cw-3qrh",
        "discovery": "UNKNOWN"
      },
      "title": "Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-47121",
    "datePublished": "2026-07-21T13:53:05.030Z",
    "dateReserved": "2026-05-18T19:50:18.694Z",
    "dateUpdated": "2026-07-22T14:30:47.083Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-47121",
      "date": "2026-11-01",
      "epss": "0.00339",
      "percentile": "0.27389"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "Sparkle",
                "vendor": "sparkle-project",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 2.9.2"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:sparkle-project:sparkle:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "68782F57-D50F-4F2F-B152-902FA2CB92C6",
                    "versionEndExcluding": "2.9.2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Sparkle is a software update framework for macOS. Prior to version 2.9.2, `Autoupdate/SUBinaryDeltaApply.m` enforces `relativePath.pathComponents containsObject:@\"..\"` and rejects writes whose immediate parent directory IS itself a symbolic link, but does not detect symlinks deeper in the relative path. `Autoupdate/SPUSparkleDeltaArchive.m`\u0027s `extractItem:` will create symlinks in the destination tree from archive content (no `..` check on the symlink target), and a subsequent `Extract` item targeting `\u003csymlink\u003e/foo/bar` then escapes the destination tree via `fopen(path, \"wb\")` because the kernel resolves the intermediate symlink during the open call. This is a defense-in-depth issue: exploitation requires a maliciously-crafted `.delta` that passes EdDSA signature verification, i.e. EdDSA private-key compromise. With the AppInstaller running as root for system-domain installs, it gives the holder of a stolen signing key arbitrary file write at root level via the delta-apply path, which is a strictly broader primitive than the \"drop-in replacement bundle\" install they would otherwise have. Version 2.9.2 contains a patch for the issue."
          },
          {
            "lang": "es",
            "value": "Sparkle es un framework de actualizaci\u00f3n de software para macOS. Antes de la versi\u00f3n 2.9.2, \u2019Autoupdate/SUBinaryDeltaApply.m\u2019 aplica \u2019relativePath.pathComponents containsObject:\u2019..\u2019 y rechaza escrituras cuyo directorio padre inmediato ES en s\u00ed mismo un enlace simb\u00f3lico, pero no detecta enlaces simb\u00f3licos m\u00e1s profundos en la ruta relativa. El \u2019extractItem:\u2019 de \u2019Autoupdate/SPUSparkleDeltaArchive.m\u2019 crear\u00e1 enlaces simb\u00f3licos en el \u00e1rbol de destino a partir del contenido del archivo (sin verificaci\u00f3n de \u2019..\u2019 en el objetivo del enlace simb\u00f3lico), y un elemento \u2019Extract\u2019 posterior que apunte a \u2019[symlink]/foo/bar\u2019 escapar\u00e1 del \u00e1rbol de destino a trav\u00e9s de \u2019fopen(path, \u201cwb\u201d)\u2019 porque el kernel resuelve el enlace simb\u00f3lico intermedio durante la llamada de apertura. Este es un problema de defensa en profundidad: la explotaci\u00f3n requiere un \u2019.delta\u2019 manipulado maliciosamente que pase la verificaci\u00f3n de firma EdDSA, es decir, el compromiso de la clave privada EdDSA. Con el AppInstaller ejecut\u00e1ndose como root para instalaciones de dominio del sistema, otorga al poseedor de una clave de firma robada la capacidad de escritura arbitraria de archivos a nivel de root a trav\u00e9s de la ruta de aplicaci\u00f3n de delta, lo cual es una primitiva estrictamente m\u00e1s amplia que la instalaci\u00f3n de \u2019paquete de reemplazo directo\u2019 que tendr\u00edan de otra manera. La versi\u00f3n 2.9.2 contiene un parche para el problema."
          }
        ],
        "id": "CVE-2026-47121",
        "lastModified": "2026-10-24T20:10:00.137",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 4.0,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-47121",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T14:30:24.947456Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-21T14:16:34.387",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/sparkle-project/Sparkle/commit/fe7b718d0736f3e139e374e26fbca96f29e13bf0"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://github.com/sparkle-project/Sparkle/security/advisories/GHSA-hg88-v3cw-3qrh"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://github.com/sparkle-project/Sparkle/security/advisories/GHSA-hg88-v3cw-3qrh"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-22"
              },
              {
                "lang": "en",
                "value": "CWE-59"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-47121",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-22T14:30:24.947456Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-22T14:30:40.892Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/sparkle-project/Sparkle/security/advisories/GHSA-hg88-v3cw-3qrh"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "Sparkle",
              "vendor": "sparkle-project",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 2.9.2"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Sparkle is a software update framework for macOS. Prior to version 2.9.2, `Autoupdate/SUBinaryDeltaApply.m` enforces `relativePath.pathComponents containsObject:@\"..\"` and rejects writes whose immediate parent directory IS itself a symbolic link, but does not detect symlinks deeper in the relative path. `Autoupdate/SPUSparkleDeltaArchive.m`\u0027s `extractItem:` will create symlinks in the destination tree from archive content (no `..` check on the symlink target), and a subsequent `Extract` item targeting `\u003csymlink\u003e/foo/bar` then escapes the destination tree via `fopen(path, \"wb\")` because the kernel resolves the intermediate symlink during the open call. This is a defense-in-depth issue: exploitation requires a maliciously-crafted `.delta` that passes EdDSA signature verification, i.e. EdDSA private-key compromise. With the AppInstaller running as root for system-domain installs, it gives the holder of a stolen signing key arbitrary file write at root level via the delta-apply path, which is a strictly broader primitive than the \"drop-in replacement bundle\" install they would otherwise have. Version 2.9.2 contains a patch for the issue."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-22",
                  "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-59",
                  "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-21T13:53:05.030Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/sparkle-project/Sparkle/security/advisories/GHSA-hg88-v3cw-3qrh",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/sparkle-project/Sparkle/security/advisories/GHSA-hg88-v3cw-3qrh"
            },
            {
              "name": "https://github.com/sparkle-project/Sparkle/commit/fe7b718d0736f3e139e374e26fbca96f29e13bf0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/sparkle-project/Sparkle/commit/fe7b718d0736f3e139e374e26fbca96f29e13bf0"
            }
          ],
          "source": {
            "advisory": "GHSA-hg88-v3cw-3qrh",
            "discovery": "UNKNOWN"
          },
          "title": "Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-47121",
        "datePublished": "2026-07-21T13:53:05.030Z",
        "dateReserved": "2026-05-18T19:50:18.694Z",
        "dateUpdated": "2026-07-22T14:30:47.083Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-47121

Vulnerability from fkie_nvd - Published: 2026-07-21 14:16 - Updated: 2026-10-24 20:10

Severity

6.1 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/sparkle-project/Sparkle/commit/fe7b718d0736f3e139e374e26fbca96f29e13bf0	Patch
security-advisories@github.com	https://github.com/sparkle-project/Sparkle/security/advisories/GHSA-hg88-v3cw-3qrh	Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/sparkle-project/Sparkle/security/advisories/GHSA-hg88-v3cw-3qrh	Vendor Advisory

Impacted products

	Vendor	Product	Version
	sparkle-project	sparkle	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Sparkle",
          "vendor": "sparkle-project",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.9.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sparkle-project:sparkle:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "68782F57-D50F-4F2F-B152-902FA2CB92C6",
              "versionEndExcluding": "2.9.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Sparkle is a software update framework for macOS. Prior to version 2.9.2, `Autoupdate/SUBinaryDeltaApply.m` enforces `relativePath.pathComponents containsObject:@\"..\"` and rejects writes whose immediate parent directory IS itself a symbolic link, but does not detect symlinks deeper in the relative path. `Autoupdate/SPUSparkleDeltaArchive.m`\u0027s `extractItem:` will create symlinks in the destination tree from archive content (no `..` check on the symlink target), and a subsequent `Extract` item targeting `\u003csymlink\u003e/foo/bar` then escapes the destination tree via `fopen(path, \"wb\")` because the kernel resolves the intermediate symlink during the open call. This is a defense-in-depth issue: exploitation requires a maliciously-crafted `.delta` that passes EdDSA signature verification, i.e. EdDSA private-key compromise. With the AppInstaller running as root for system-domain installs, it gives the holder of a stolen signing key arbitrary file write at root level via the delta-apply path, which is a strictly broader primitive than the \"drop-in replacement bundle\" install they would otherwise have. Version 2.9.2 contains a patch for the issue."
    },
    {
      "lang": "es",
      "value": "Sparkle es un framework de actualizaci\u00f3n de software para macOS. Antes de la versi\u00f3n 2.9.2, \u2019Autoupdate/SUBinaryDeltaApply.m\u2019 aplica \u2019relativePath.pathComponents containsObject:\u2019..\u2019 y rechaza escrituras cuyo directorio padre inmediato ES en s\u00ed mismo un enlace simb\u00f3lico, pero no detecta enlaces simb\u00f3licos m\u00e1s profundos en la ruta relativa. El \u2019extractItem:\u2019 de \u2019Autoupdate/SPUSparkleDeltaArchive.m\u2019 crear\u00e1 enlaces simb\u00f3licos en el \u00e1rbol de destino a partir del contenido del archivo (sin verificaci\u00f3n de \u2019..\u2019 en el objetivo del enlace simb\u00f3lico), y un elemento \u2019Extract\u2019 posterior que apunte a \u2019[symlink]/foo/bar\u2019 escapar\u00e1 del \u00e1rbol de destino a trav\u00e9s de \u2019fopen(path, \u201cwb\u201d)\u2019 porque el kernel resuelve el enlace simb\u00f3lico intermedio durante la llamada de apertura. Este es un problema de defensa en profundidad: la explotaci\u00f3n requiere un \u2019.delta\u2019 manipulado maliciosamente que pase la verificaci\u00f3n de firma EdDSA, es decir, el compromiso de la clave privada EdDSA. Con el AppInstaller ejecut\u00e1ndose como root para instalaciones de dominio del sistema, otorga al poseedor de una clave de firma robada la capacidad de escritura arbitraria de archivos a nivel de root a trav\u00e9s de la ruta de aplicaci\u00f3n de delta, lo cual es una primitiva estrictamente m\u00e1s amplia que la instalaci\u00f3n de \u2019paquete de reemplazo directo\u2019 que tendr\u00edan de otra manera. La versi\u00f3n 2.9.2 contiene un parche para el problema."
    }
  ],
  "id": "CVE-2026-47121",
  "lastModified": "2026-10-24T20:10:00.137",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 4.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-47121",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-22T14:30:24.947456Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-21T14:16:34.387",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/sparkle-project/Sparkle/commit/fe7b718d0736f3e139e374e26fbca96f29e13bf0"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/sparkle-project/Sparkle/security/advisories/GHSA-hg88-v3cw-3qrh"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/sparkle-project/Sparkle/security/advisories/GHSA-hg88-v3cw-3qrh"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-59"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-HG88-V3CW-3QRH

Vulnerability from github – Published: 2026-05-29 19:45 – Updated: 2026-07-21 13:52

Summary

Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta

Details

Summary

Binary delta apply intermediate-symlink traversal in malicious .delta

Autoupdate/SUBinaryDeltaApply.m enforces relativePath.pathComponents containsObject:@".." and rejects writes whose immediate parent directory IS itself a symbolic link, but does not detect symlinks deeper in the relative path. Autoupdate/SPUSparkleDeltaArchive.m's extractItem: will create symlinks in the destination tree from archive content (no .. check on the symlink target), and a subsequent Extract item targeting <symlink>/foo/bar then escapes the destination tree via fopen(path, "wb") because the kernel resolves the intermediate symlink during the open call.

This is a defense-in-depth issue: exploitation requires a maliciously-crafted .delta that passes EdDSA signature verification, i.e. EdDSA private-key compromise. With the AppInstaller running as root for system-domain installs, it gives the holder of a stolen signing key arbitrary file write at root level via the delta-apply path, which is a strictly broader primitive than the "drop-in replacement bundle" install they would otherwise have.

Affected versions: 1.x (master branch), 2.x branch including 2.9.1.

Details

Symlink writeable from archive

Autoupdate/SPUSparkleDeltaArchive.m:557-678's extractItem: handles symlinks if the archive item carries S_ISLNK(mode):

} else {
    // Link files

    if (PARTIAL_IO_CHUNK_SIZE < decodedLength) { ...too long... }
    if (decodedLength > PATH_MAX) { ...too long... }

    char buffer[PATH_MAX + 1] = {0};
    if (![self _readBuffer:buffer length:(int32_t)decodedLength]) { ... }

    NSString *destinationPath = [fileManager stringWithFileSystemRepresentation:buffer length:decodedLength];

    [fileManager removeItemAtPath:itemFilePath error:NULL];

    NSError *createLinkError = nil;
    if (![fileManager createSymbolicLinkAtPath:itemFilePath withDestinationPath:destinationPath error:&createLinkError]) {
        _error = createLinkError;
        return NO;
    }
    ...
    lchmod(itemFilePathString, mode);
}

The link's destinationPath is taken verbatim from the archive content with only a length cap; absolute paths and .. are accepted. After this item is processed, the destination tree contains a symlink that points outside it.

Parent-symlink check is shallow

Autoupdate/SUBinaryDeltaApply.m:177-207:

[archive enumerateItems:^(SPUDeltaArchiveItem *item, BOOL *stop) {
    NSString *relativePath = item.relativeFilePath;

    if ([relativePath.pathComponents containsObject:@".."]) {
        ...reject...
    }

    NSString *sourceFilePath = [source stringByAppendingPathComponent:relativePath];
    NSString *destinationFilePath = [destination stringByAppendingPathComponent:relativePath];
    {
        NSString *destinationParentDirectory = destinationFilePath.stringByDeletingLastPathComponent;
        NSDictionary<NSFileAttributeKey, id> *destinationParentDirectoryAttributes = [fileManager attributesOfItemAtPath:destinationParentDirectory error:NULL];

        // It is OK for the directory parent to not exist if it has already been removed
        if (destinationParentDirectoryAttributes != nil) {
            NSString *fileType = destinationParentDirectoryAttributes[NSFileType];
            if ([fileType isEqualToString:NSFileTypeSymbolicLink]) {
                ...reject...
            }
        }
    }
    ...
}];

Two gaps:

The check inspects only destinationParentDirectory (one level up), not all intermediate components. For a relative path a/b/c.txt, the kernel resolves through any symlink at component a. attributesOfItemAtPath: with the resolved path returns attributes of the resolved-through directory, which is NSFileTypeDirectory (not NSFileTypeSymbolicLink), so the check passes.
The check is skipped entirely if destinationParentDirectoryAttributes == nil (line 195). When the symlink target is to a directory that does not contain the named subpath, the parent appears not to exist and the check is skipped. The subsequent fopen(path, "wb") then creates the file along the resolved path.

Write primitive

For an item with SPUDeltaItemCommandExtract set, SUBinaryDeltaApply.m:354-365 calls [archive extractItem:item] which goes through SPUSparkleDeltaArchive.m:574-622 for regular files:

[fileManager removeItemAtPath:itemFilePath error:NULL];

char itemFilePathString[PATH_MAX + 1] = {0};
if (![itemFilePath getFileSystemRepresentation:itemFilePathString maxLength:sizeof(itemFilePathString) - 1]) { ... }

FILE *outputFile = fopen(itemFilePathString, "wb");

fopen(path, "wb") follows symlinks at every path component and creates/truncates the file at the resolved path. If <dest>/a is a symlink to /Library/LaunchDaemons (for a root install) and the relative path is a/com.attacker.plist, the call writes /Library/LaunchDaemons/com.attacker.plist.

The chmod follow-up at SUBinaryDeltaApply.m:335 (chmod(destinationFilePath.fileSystemRepresentation, sourceFileInfo.st_mode)) and SPUSparkleDeltaArchive.m:619 (chmod(itemFilePathString, mode)) likewise follows symlinks, so attacker-chosen permissions land on the attacker-chosen target.

Threat model

This primitive is reachable only when the archive can pass EdDSA signature verification, which requires either:

The developer's private signing key has been compromised, or
A separate vulnerability allows bypassing SUSignatureVerifier (none was identified in this review).

Given a stolen private key, the attacker already has the ability to push a normal full-bundle update. The delta-apply traversal grants strictly more: arbitrary file write into directories outside <destination>. When the AppInstaller runs in the system domain (root), this becomes arbitrary file write as root, which is qualitatively broader than "replace the app bundle".

It is therefore worth fixing as a defense-in-depth measure, even though the prerequisite (key compromise) is itself a worst case.

PoC

The PoC requires a valid EdDSA signature on the malicious .delta archive. With a test signing key under your control (any Sparkle test fixture key), generate a delta as follows:

Construct the archive payload with two items, in this order, using the SPUSparkleDeltaArchive writer (or by hand-assembling the format described in SPUSparkleDeltaArchive.m and SPUDeltaArchiveProtocol.h):

Item 1:
  relativeFilePath = "Contents/Resources/escape"
  commands         = SPUDeltaItemCommandExtract  (= 0x02)
  mode             = S_IFLNK | 0o755             (= 0xA1ED)
  payload          = "/Library/LaunchDaemons"

Item 2:
  relativeFilePath = "Contents/Resources/escape/com.attacker.persistence.plist"
  commands         = SPUDeltaItemCommandExtract  (= 0x02)
  mode             = S_IFREG | 0o644             (= 0x81A4)
  payload          = <attacker-chosen LaunchDaemon plist bytes>

Sign the archive with the test EdDSA key, publish it as a delta enclosure with matching sparkle:edSignature, and host it from a feed pointed at by a Sparkle host whose old-bundle public key matches.
Trigger a system-domain install. The flow:
applyBinaryDelta enumerates items.
Item 1 passes the .. check (the path components are Contents, Resources, escape - no ..). The parent Contents/Resources exists in the source-copy and is a directory, not a symlink. The check passes. extractItem: for S_ISLNK(mode) calls createSymbolicLinkAtPath:withDestinationPath: and creates <dest>/Contents/Resources/escape -> /Library/LaunchDaemons.
Item 2 passes the .. check. Its parent <dest>/Contents/Resources/escape resolves through the just-created symlink to /Library/LaunchDaemons, whose attributes are returned as NSFileTypeDirectory (not symlink). The check passes.
extractItem: for S_ISREG(mode) does removeItemAtPath (no-op, target file does not yet exist) then fopen("<dest>/Contents/Resources/escape/com.attacker.persistence.plist", "wb"). The kernel resolves the symlink and creates /Library/LaunchDaemons/com.attacker.persistence.plist.
The hash check at the end of applyBinaryDelta (getRawHashOfTreeWithVersion(afterHash, finalDestination, ...)) is computed only against finalDestination. The file dropped at /Library/LaunchDaemons/ is outside that tree and does not affect the hash. The hash check still passes (or, if it does not because the dest tree is missing the file, the dropped LaunchDaemon plist is still left behind - destination cleanup at line 471 only removes finalDestination, not the escape target).
Observed result: a root-owned LaunchDaemon plist exists at /Library/LaunchDaemons/com.attacker.persistence.plist. On next reboot it is launched as root.

A simpler proof-of-concept that does not require a system-domain install: target a user-writable directory (e.g. ~/Library/LaunchAgents/), use a user-domain Sparkle host. The same item-pair lands a user-level LaunchAgent at next login.

Impact

Defense-in-depth gap: the holder of a compromised EdDSA signing key gains a primitive (arbitrary file write at the privilege of the AppInstaller process) that exceeds what an "install a malicious bundle" path provides. For system-domain installs this is arbitrary file write as root, including locations outside the target app bundle (/Library/LaunchDaemons, /etc/... subpaths that exist as directories, /usr/local/, etc.).

Recommended fix: in SUBinaryDeltaApply.m, walk every component of relativePath and reject if any intermediate component is a symlink (or refuse to allow the archive to create symlinks during apply at all, given the limited number of legitimate use cases for symlinks inside an .app bundle and the existing lchmod already in place). Cleanup on failure should also removeTree along the symlink target, not just finalDestination.

Severity

6.1 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.9.1"
      },
      "package": {
        "ecosystem": "SwiftURL",
        "name": "github.com/sparkle-project/Sparkle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47121"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-59"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-29T19:45:04Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nBinary delta apply intermediate-symlink traversal in malicious .delta\n\n`Autoupdate/SUBinaryDeltaApply.m` enforces `relativePath.pathComponents containsObject:@\"..\"` and rejects writes whose immediate parent directory IS itself a symbolic link, but does not detect symlinks deeper in the relative path. `Autoupdate/SPUSparkleDeltaArchive.m`\u0027s `extractItem:` will create symlinks in the destination tree from archive content (no `..` check on the symlink target), and a subsequent `Extract` item targeting `\u003csymlink\u003e/foo/bar` then escapes the destination tree via `fopen(path, \"wb\")` because the kernel resolves the intermediate symlink during the open call.\n\nThis is a defense-in-depth issue: exploitation requires a maliciously-crafted `.delta` that passes EdDSA signature verification, i.e. EdDSA private-key compromise. With the AppInstaller running as root for system-domain installs, it gives the holder of a stolen signing key arbitrary file write at root level via the delta-apply path, which is a strictly broader primitive than the \"drop-in replacement bundle\" install they would otherwise have.\n\nAffected versions: 1.x (master branch), 2.x branch including 2.9.1.\n\n## Details\n\n### Symlink writeable from archive\n\n`Autoupdate/SPUSparkleDeltaArchive.m:557-678`\u0027s `extractItem:` handles symlinks if the archive item carries `S_ISLNK(mode)`:\n\n```objc\n} else {\n    // Link files\n\n    if (PARTIAL_IO_CHUNK_SIZE \u003c decodedLength) { ...too long... }\n    if (decodedLength \u003e PATH_MAX) { ...too long... }\n\n    char buffer[PATH_MAX + 1] = {0};\n    if (![self _readBuffer:buffer length:(int32_t)decodedLength]) { ... }\n\n    NSString *destinationPath = [fileManager stringWithFileSystemRepresentation:buffer length:decodedLength];\n\n    [fileManager removeItemAtPath:itemFilePath error:NULL];\n\n    NSError *createLinkError = nil;\n    if (![fileManager createSymbolicLinkAtPath:itemFilePath withDestinationPath:destinationPath error:\u0026createLinkError]) {\n        _error = createLinkError;\n        return NO;\n    }\n    ...\n    lchmod(itemFilePathString, mode);\n}\n```\n\nThe link\u0027s `destinationPath` is taken verbatim from the archive content with only a length cap; absolute paths and `..` are accepted. After this item is processed, the destination tree contains a symlink that points outside it.\n\n### Parent-symlink check is shallow\n\n`Autoupdate/SUBinaryDeltaApply.m:177-207`:\n\n```objc\n[archive enumerateItems:^(SPUDeltaArchiveItem *item, BOOL *stop) {\n    NSString *relativePath = item.relativeFilePath;\n\n    if ([relativePath.pathComponents containsObject:@\"..\"]) {\n        ...reject...\n    }\n\n    NSString *sourceFilePath = [source stringByAppendingPathComponent:relativePath];\n    NSString *destinationFilePath = [destination stringByAppendingPathComponent:relativePath];\n    {\n        NSString *destinationParentDirectory = destinationFilePath.stringByDeletingLastPathComponent;\n        NSDictionary\u003cNSFileAttributeKey, id\u003e *destinationParentDirectoryAttributes = [fileManager attributesOfItemAtPath:destinationParentDirectory error:NULL];\n\n        // It is OK for the directory parent to not exist if it has already been removed\n        if (destinationParentDirectoryAttributes != nil) {\n            NSString *fileType = destinationParentDirectoryAttributes[NSFileType];\n            if ([fileType isEqualToString:NSFileTypeSymbolicLink]) {\n                ...reject...\n            }\n        }\n    }\n    ...\n}];\n```\n\nTwo gaps:\n\n1. The check inspects only `destinationParentDirectory` (one level up), not all intermediate components. For a relative path `a/b/c.txt`, the kernel resolves through any symlink at component `a`. `attributesOfItemAtPath:` with the resolved path returns attributes of the resolved-through directory, which is `NSFileTypeDirectory` (not `NSFileTypeSymbolicLink`), so the check passes.\n\n2. The check is skipped entirely if `destinationParentDirectoryAttributes == nil` (line 195). When the symlink target is to a directory that does not contain the named subpath, the parent appears not to exist and the check is skipped. The subsequent `fopen(path, \"wb\")` then creates the file along the resolved path.\n\n### Write primitive\n\nFor an item with `SPUDeltaItemCommandExtract` set, `SUBinaryDeltaApply.m:354-365` calls `[archive extractItem:item]` which goes through `SPUSparkleDeltaArchive.m:574-622` for regular files:\n\n```objc\n[fileManager removeItemAtPath:itemFilePath error:NULL];\n\nchar itemFilePathString[PATH_MAX + 1] = {0};\nif (![itemFilePath getFileSystemRepresentation:itemFilePathString maxLength:sizeof(itemFilePathString) - 1]) { ... }\n\nFILE *outputFile = fopen(itemFilePathString, \"wb\");\n```\n\n`fopen(path, \"wb\")` follows symlinks at every path component and creates/truncates the file at the resolved path. If `\u003cdest\u003e/a` is a symlink to `/Library/LaunchDaemons` (for a root install) and the relative path is `a/com.attacker.plist`, the call writes `/Library/LaunchDaemons/com.attacker.plist`.\n\nThe `chmod` follow-up at `SUBinaryDeltaApply.m:335` (`chmod(destinationFilePath.fileSystemRepresentation, sourceFileInfo.st_mode)`) and `SPUSparkleDeltaArchive.m:619` (`chmod(itemFilePathString, mode)`) likewise follows symlinks, so attacker-chosen permissions land on the attacker-chosen target.\n\n### Threat model\n\nThis primitive is reachable only when the archive can pass EdDSA signature verification, which requires either:\n\n- The developer\u0027s private signing key has been compromised, or\n- A separate vulnerability allows bypassing `SUSignatureVerifier` (none was identified in this review).\n\nGiven a stolen private key, the attacker already has the ability to push a normal full-bundle update. The delta-apply traversal grants strictly more: arbitrary file write into directories outside `\u003cdestination\u003e`. When the AppInstaller runs in the system domain (root), this becomes arbitrary file write as root, which is qualitatively broader than \"replace the app bundle\".\n\nIt is therefore worth fixing as a defense-in-depth measure, even though the prerequisite (key compromise) is itself a worst case.\n\n## PoC\n\nThe PoC requires a valid EdDSA signature on the malicious `.delta` archive. With a test signing key under your control (any Sparkle test fixture key), generate a delta as follows:\n\n1. Construct the archive payload with two items, in this order, using the `SPUSparkleDeltaArchive` writer (or by hand-assembling the format described in `SPUSparkleDeltaArchive.m` and `SPUDeltaArchiveProtocol.h`):\n\n```\nItem 1:\n  relativeFilePath = \"Contents/Resources/escape\"\n  commands         = SPUDeltaItemCommandExtract  (= 0x02)\n  mode             = S_IFLNK | 0o755             (= 0xA1ED)\n  payload          = \"/Library/LaunchDaemons\"\n\nItem 2:\n  relativeFilePath = \"Contents/Resources/escape/com.attacker.persistence.plist\"\n  commands         = SPUDeltaItemCommandExtract  (= 0x02)\n  mode             = S_IFREG | 0o644             (= 0x81A4)\n  payload          = \u003cattacker-chosen LaunchDaemon plist bytes\u003e\n```\n\n2. Sign the archive with the test EdDSA key, publish it as a delta enclosure with matching `sparkle:edSignature`, and host it from a feed pointed at by a Sparkle host whose old-bundle public key matches.\n\n3. Trigger a system-domain install. The flow:\n   - `applyBinaryDelta` enumerates items.\n   - Item 1 passes the `..` check (the path components are `Contents`, `Resources`, `escape` - no `..`). The parent `Contents/Resources` exists in the source-copy and is a directory, not a symlink. The check passes. `extractItem:` for `S_ISLNK(mode)` calls `createSymbolicLinkAtPath:withDestinationPath:` and creates `\u003cdest\u003e/Contents/Resources/escape -\u003e /Library/LaunchDaemons`.\n   - Item 2 passes the `..` check. Its parent `\u003cdest\u003e/Contents/Resources/escape` resolves through the just-created symlink to `/Library/LaunchDaemons`, whose attributes are returned as `NSFileTypeDirectory` (not symlink). The check passes.\n   - `extractItem:` for `S_ISREG(mode)` does `removeItemAtPath` (no-op, target file does not yet exist) then `fopen(\"\u003cdest\u003e/Contents/Resources/escape/com.attacker.persistence.plist\", \"wb\")`. The kernel resolves the symlink and creates `/Library/LaunchDaemons/com.attacker.persistence.plist`.\n   - The hash check at the end of `applyBinaryDelta` (`getRawHashOfTreeWithVersion(afterHash, finalDestination, ...)`) is computed only against `finalDestination`. The file dropped at `/Library/LaunchDaemons/` is outside that tree and does not affect the hash. The hash check still passes (or, if it does not because the dest tree is missing the file, the dropped LaunchDaemon plist is still left behind - destination cleanup at line 471 only removes `finalDestination`, not the escape target).\n\n4. Observed result: a root-owned LaunchDaemon plist exists at `/Library/LaunchDaemons/com.attacker.persistence.plist`. On next reboot it is launched as root.\n\nA simpler proof-of-concept that does not require a system-domain install: target a user-writable directory (e.g. `~/Library/LaunchAgents/`), use a user-domain Sparkle host. The same item-pair lands a user-level LaunchAgent at next login.\n\n## Impact\n\nDefense-in-depth gap: the holder of a compromised EdDSA signing key gains a primitive (arbitrary file write at the privilege of the AppInstaller process) that exceeds what an \"install a malicious bundle\" path provides. For system-domain installs this is arbitrary file write as root, including locations outside the target app bundle (`/Library/LaunchDaemons`, `/etc/...` subpaths that exist as directories, `/usr/local/`, etc.).\n\nRecommended fix: in `SUBinaryDeltaApply.m`, walk every component of `relativePath` and reject if any intermediate component is a symlink (or refuse to allow the archive to create symlinks during apply at all, given the limited number of legitimate use cases for symlinks inside an `.app` bundle and the existing `lchmod` already in place). Cleanup on failure should also `removeTree` along the symlink target, not just `finalDestination`.",
  "id": "GHSA-hg88-v3cw-3qrh",
  "modified": "2026-07-21T13:52:01Z",
  "published": "2026-05-29T19:45:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/sparkle-project/Sparkle/security/advisories/GHSA-hg88-v3cw-3qrh"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sparkle-project/Sparkle/commit/fe7b718d0736f3e139e374e26fbca96f29e13bf0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/sparkle-project/Sparkle"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-47121 (GCVE-0-2026-47121)

FKIE_CVE-2026-47121

GHSA-HG88-V3CW-3QRH

Summary

Details

Symlink writeable from archive

Parent-symlink check is shallow

Write primitive

Threat model

PoC

Impact

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour